Hi community, please help me in publishing azure managed application to azure marketplace?

Hi ,

Thanks for reaching out to Microsoft Q&A.

Publishing an azure Managed Application to the Azure Marketplace with web app code deployment to the customer tenant can be tricky due to security boundaries and deployment limitations. Let me walk you through key issues you are hitting, why they happen, and suggest best practices or alternatives.

1. Using PAT in ARM extension resource

Problem: PAT verification failed.

Reason: PATs (Personal Access Tokens) are not the right way to authenticate deployments in ARM templates, especially from Marketplace offers. Marketplace sandboxes limit the ability to use secrets/tokens directly for security reasons.

2. Key Vault in publisher tenant accessed by customer deployment

Problem: ARM is looking for publisher’s Key Vault in customer tenant.

Reason: ARM template runs in customer's context, so it cannot access resources in publisher’s tenant (like your Key Vault).

• Fix: You must embed necessary artifacts or use publicly accessible URLs (ex: Azure Blob with SAS tokens) instead of private KeyVault access.

3. ARM template package size exceeding 120MB

Problem: Artifact too large when packaging code + infra.

• Solution:
  • Break the deployment into multiple smaller templates and use linked templates via a publicly accessible Blob Storage with SAS tokens.
  Consider external deployment automation post resource provisioning (detailed below).

Best Practices to Publish Azure Managed Application with Code Deployment

A. Separation of Infra and App Code

ARM templates are designed to provision infrastructure, not to deploy full-scale applications (especially code). Ideally:

1. Use ARM/Bicep to deploy resources (App Service, KeyVault, etc.).

Use custom script extension, Azure DevOps pipeline, or GitHub Actions to deploy app code post-deployment.

B. Use a Deployment Script in ARM

Use ARM template with a Microsoft.Resources/deploymentScripts resource that:

• Pulls code from a public/private repo (you can inject secrets via parameters or Key Vault within the customer's environment).
• Deploys the app using az webapp deployment or zipdeploy.

C. Deliver App via Azure Storage and Download in Customer Tenant

• Upload your zipped application code to a Storage Account with a timebound SAS token.

In customer deployment, use deployment scripts or custom extensions to download and deploy to the web app.

D. Use Managed Identity for Secure Deployment (if applicable)

If your deployment involves sensitive actions (fetching secrets from customer side Key Vaults), ensure your deployment script or resource uses System Assigned Managed Identity with necessary permissions.

Please feel free to click the 'Upvote' (Thumbs-up) button and 'Accept as Answer'. This helps the community by allowing others with similar queries to easily find the solution.